Debugging Tools for Windows

Bug Check 0x10D: WDF_VIOLATION

The WDF_VIOLATION bug check has a value of 0x0000010D. This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.


The following parameters are displayed on the blue screen. Parameter 1 indicates the specific error code of the bug check. Parameter 4 is reserved.

Parameter 1 Parameter 2 Parameter 3 Cause of Error
0x1 Pointer to a WDF_POINTER_ROUTINE_TIMED_OUT_DATA structure Reserved A framework-based driver has timed out during a power operation. This typically means that the device stack did not set the DO_POWER_PAGABLE bit and a driver attempted a pageable operation after the paging device stack was powered down.
0x2 Reserved Reserved An attempt is being made to acquire a lock that is currently being held.
0x3 WDFREQUEST handle The number of outstanding references that remain on both buffers Windows Driver Framework Verifier has encountered a fatal error. In particular, an I/O request was completed, but a framework request object cannot be deleted because there are outstanding references to the input buffer, the output buffer, or both.
0x4 Reserved The caller's address A NULL parameter was passed to a function that required a non-NULL value.
0x5 The handle value passed in Reserved A framework object handle of the incorrect type was passed to a framework object method.
0x6 See table below.
0x7 The handle of the framework object Reserved A driver attempted to delete a framework object incorrectly by calling WdfObjectDereference to delete a handle instead of calling WdfObjectDelete.
0x8 The handle of the DMA transaction object Reserved An operation occurred on a DMA transaction object while it was not in the correct state.
0x9 Currently unused.
0xA A pointer to a WDF_QUEUE_FATAL_ERROR_DATA structure Reserved A fatal error has occurred while processing a request that is currently in the queue.

0xB See table below.

If Parameter 1 is equal to 0x6, then a fatal error was made in handling a WDF request. In this case, Parameter 2 further specifies the type of fatal error that has been made, as defined by the enumeration WDF_REQUEST_FATAL_ERROR.

Parameter 2 Parameter 3 Cause of Error
0x1 The address of the IRP No more I/O stack locations are available to format the underlying IRP.
0x2 The WDF request handle value An attempt was made to format a framework request object that did not contain an IRP.
0x3 The WDF request handle value The driver attempted to send a framework request that has already been sent to an I/O target.
0x4 A pointer to a WDR_REQUEST_FATAL_ERROR_INFORMATION_LENGTH_MISMATCH_DATA structure that contains a pointer to the IRP, a WDF request handle value, an IRP major function, and the number of bytes attempted to be written The driver has completed a framework request, but has written more bytes to the output buffer than are specified in the IRP.

If Parameter 1 is equal to 0xB, then an attempt to acquire or release a lock was invalid. In this case, Parameter 3 further specifies the error that has been made.

Parameter 2 Parameter 3 Cause of Error
The handle value 0x0 A handle passed to WdfObjectAcquireLock or WdfObjectReleaseLock represents an object that does not support synchronization locks.
A WDF spin lock handle 0x1 The spin lock is being released by a thread that did not acquire it.


See the description of each code in the Parameters section for an explanation of the cause.

Resolving the Problem

Typically, the dump file will yield further information on the driver that caused this bug check.

If Parameter 1 is equal to 0x2, examine the caller’s stack to determine the lock in question.

If Parameter 1 is equal to 0x3, the driver's Kernel-Mode Driver Framework error log will include details about the outstanding references.

If Parameter 1 is equal to 0x4, use the ln debugger command with the value of Parameter 3 as its argument to determine which function requires a non-NULL parameter.

If Parameter 1 is equal to 0x7, use the !wdfkd.wdfhandle Parameter 2 extension command to determine the handle type.

If Parameter 1 is equal to 0xA, then the WDF_QUEUE_FATAL_ERROR_DATA structure will indicate either the problematic request or the queue handle. It will also indicate the NTSTATUS, if not STATUS_SUCCESS, when available.

Build machine: CAPEBUILD